No query had a bug. Another tenant still got Tenant A's rows.

transcript

Every query was correct. Row-level security was on. And a request still read another tenant's rows.

A request for Tenant A borrows a pooled connection. It sets the current tenant on that connection: Tenant A. Row-level security filters every query by it. Only A's rows come back.

But pooled connections are reused. Across requests, and across tenants. Tenant A's request finishes, and returns its connection. The next request borrows that same connection. A different tenant. It inherits Tenant A. Its queries run as the wrong tenant.

No query was wrong. The connection remembered. A cross-tenant leak, with no bug in any query.

Without a reset, the next borrower inherits Tenant A. So clear the tenant before every release. Each borrower starts with none. And a missing tenant fails row-level security. It never leaks.

Why do tests miss it? One tenant at a time never shows it. It only appears when many tenants run at once. So check isolation during load tests too.

A pooled connection carries whatever the last request left on it. Clear the tenant on every release.

Full breakdown in the lecture.